Protection of Audit Information AU-9
Audit and Accountability · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds AU-9 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
AU-9 (Protection of Audit Information) protects the logs themselves — and the tools that create them — from unauthorized access, change, or deletion. If an attacker can edit or wipe the audit trail, the trail cannot be trusted. Its enhancements point toward keeping a copy somewhere separate. It is part of the Moderate baseline.
What good looks like
- Restrict access to audit information to only the roles that need it.
- Protect logs from modification and deletion, not just from being read.
- Protect the logging tools themselves (for example
auditd) from tampering. - Back up or copy audit records to a separate system so they survive a host compromise (enhancement AU-9(2)).
Framework mapping
- NIST CSF 2.0 — PR.PS-04 — Log integrity is protected so records can be trusted
- CIS Controls v8 — Control 8.3 — Ensure adequate, protected audit log storage
How to move it toward Implemented
- Some protection exists: root login is disabled, SSH (Secure Shell) is key-only with
AllowUsers,auditdwatches/var/log/auth.log, and AIDE (Advanced Intrusion Detection Environment) baselines files to detect tampering. - The missing pieces harden the logs at rest: tighten log-file permissions, set the append-only attribute on audit logs (
chattr +a), and ship a copy off-host withrsyslogforwarding so a compromised host cannot silently erase its own trail. - Enable a central syslog target (the runbook currently leaves it optional), then attach the forwarding config and a permission listing as asset-scoped evidence naming AU-9 to move from partial toward Completed.